Do nulled scripts contain malware?

Do nulled scripts contain malware or is that just hype?

I'd like to see file comparisons with diff tools to see what PHP lines have been altered. Anything like that ever available?

For Wordpress, specifically, what do you use to scan for malware in your plugins?